Grav is a file‑based Web platform. Prior to version 3.8.5, the Login plugin’s twofa_cancel task accepts a client‑controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol‑relative Location target. Controller::execute() applies this field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target via Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This flaw satisfies CWE‑601 – Open Redirect – and is fixed in release 3.8.5.

All Grav installations using getgrav:grav with the login plugin version earlier than 3.8.5 are vulnerable. The 3.8.5 release of the plugin resolves the issue. Users should verify they are running at least this version of grav‑plugin‑login.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score is 0.00386 (<1%), and the vulnerability is not listed in CISA’s KEV catalog. The attack requires only an unauthenticated HTTP request to a Grav instance with a vulnerable plugin, making it straightforward for automated exploitation. The primary consequence is a user's browser being redirected to a malicious external site, which can facilitate phishing or drive‑by compromise.